Back to Checks
m365

Users allowed to join devices to Microsoft Entra are restricted

entra_device_registration_join_restricted
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

The tenant device registration policy should restrict who can register devices as Microsoft Entra joined to Selected users or None. Allowing all users to join devices increases the number of devices that establish a trust relationship with the tenant.

Prowler logoProwlerprowler-provider-m365

Risk

When all users can Entra-join devices, an attacker who compromises any account can register a device, potentially satisfying device-based Conditional Access controls and expanding their foothold in the tenant.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_device_registration_join_restricted

Recommendation

Restrict Entra device join to a selected set of users or disable it entirely unless there is a business need for all users to join devices.

Remediation

Other

1Navigate to the Microsoft Entra admin center at https://entra.microsoft.com/
2Go to **Identity** > **Devices** > **Device settings**
3Set **Users may join devices to Microsoft Entra** to **Selected** (and choose the allowed users/groups) or **None**
4Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client
from prowler.providers.m365.services.entra.entra_service import (
    DeviceRegistrationMembershipType,
)

RESTRICTED_MEMBERSHIP_TYPES = {
    DeviceRegistrationMembershipType.ENUMERATED.value,
    DeviceRegistrationMembershipType.NONE.value,
}


class entra_device_registration_join_restricted(Check):
    """Check if the users allowed to join devices to Entra are restricted.

    The device registration policy should restrict who can register devices as
    Microsoft Entra joined to Selected users or None, rather than allowing all
    users.

    - PASS: Only selected users or no users may join devices to Entra.
    - FAIL: The users allowed to join devices are not restricted to Selected or None.
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the Entra device join restriction check.

        Returns:
            List[CheckReportM365]: A list containing the result of the check.
        """
        findings = []
        policy = entra_client.device_registration_policy
        if not policy:
            return findings

        report = CheckReportM365(
            metadata=self.metadata(),
            resource=policy,
            resource_name="Device Registration Policy",
            resource_id="deviceRegistrationPolicy",
        )
        report.status = "FAIL"
        report.status_extended = (
            "The users allowed to join devices to Microsoft Entra are not "
            "restricted to selected users or none."
        )

        if policy.azure_ad_join_allowed_to_join_type in RESTRICTED_MEMBERSHIP_TYPES:
            report.status = "PASS"
            report.status_extended = (
                "Only selected users or no users are allowed to join devices to "
                "Microsoft Entra."
            )

        findings.append(report)
        return findings

References